Mendix Saml Mendix 10 Compatible
Monthly
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.
SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis.